pwn5_www2

pwn_spbctf

Task: NON-PIE x86-64 binary with stack canary, a custom .init_array constructor that prints /proc/self/maps (free libc leak) before main, and an 8-byte write-what-where (raw value + decimal strtol address). Solution: parse libc base from the startup maps dump, overwrite puts@GOT with system via the WWW primitive, then feed '/bin/sh' to the buffer so the later puts(rbp) becomes system('/bin/sh').